Web Animations Password Protect Multiple Input Validation Vulnerabilities

Bugtraq ID:	11073
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 31 2004 12:00AM
Updated:	Aug 31 2004 12:00AM
Credit:	Discovery is credited to Criolabs.
Vulnerable:	Web Animations Password Protect
Not Vulnerable:

Web Animations Password Protect Multiple Input Validation Vulnerabilities

Password Protect is reported prone to a multiple cross-site scripting and SQL injection vulnerabilities. These issues occur due to insufficient sanitization of user-supplied input. Successful exploitation of these issues may result in arbitrary HTML and script code execution and/or compromise of the underlying database.

It is reported that these issues could be exploited to gain unauthorized administrative access to the application.

All versions of Password Protect are considered vulnerable to these issues.

Web Animations Password Protect Multiple Input Validation Vulnerabilities

No exploit is required.

The following proof of concept examples are available:

SQL injection:
/adminSection/index_next.asp?admin = (SQLInjection) Pass = (SQLInjection)

/adminSection/ChangePassword.asp?LoginId=(SQLInjection) OPass=(SQLInjection) NPass=(SQLInjection) CPass=(SQLInjection)

Cross-site scripting:
/adminSection/index.asp?ShowMsg=(XSS)
/adminSection/ChangePassword.asp?ShowMsg=(XSS)
/adminSection/users_list.asp?ShowMsg=(XSS)
/adminSection/users_add.asp?ShowMsg=(XSS)

Web Animations Password Protect Multiple Input Validation Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Web Animations Password Protect Multiple Input Validation Vulnerabilities

References:

• Password Protect Product Page (Web Animations)
  
• Password Protect XSS and SQL-Injection vulnerabilities. (Criolabs )